ClawHub
Back to skill

Security audit

Firestore

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about using Google Cloud credentials for Firestore CRUD, but its curl-based command construction creates a real review-worthy risk around shell injection and high-impact database actions.

Review this skill before installing. Use it only with a dedicated least-privilege service account and a non-production or tightly scoped project. Carefully inspect generated curl commands, especially any values containing quotes, dollar signs, backticks, newlines, semicolons, ampersands, or unusual path/query characters, because the current examples do not provide strong shell-injection safeguards.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
examples.md:118
Finding

Shell Command Injection Through Unsafely Interpolated Firestore Input

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The skill is designed to obtain and use live OAuth access tokens from the local gcloud context, which grants the skill direct access to whatever Firestore permissions the active identity holds. Even though the document includes warnings and recommends service accounts, the mechanism still exposes a high-value credential path that could enable unauthorized data access or modification if the agent mishandles commands, context, or output.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
## Credentials & Environment

This skill uses OAuth 2.0 access tokens generated by `gcloud auth print-access-token`. The token is valid for a limited time (typically 1 hour) and inherits the permissions of the authenticated Google Cloud account.

This skill must run only with a dedicated service account context. Do not use personal user credentials or broad admin identities.

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

This line provides a concrete command for generating a fresh access token and storing it in an environment variable, making credential acquisition operationally trivial. In the context of an agent skill with command execution capability, that creates a real risk of credential misuse, accidental disclosure, or use against the wrong project if safeguards fail.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

This skill must run only with a dedicated service account context. Do not use personal user credentials or broad admin identities.

Before any operation, generate a fresh access token:

bash
ACCESS_TOKEN=$(gcloud auth print-access-token)

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

Embedding token generation as a mandatory workflow step normalizes credential retrieval for every operation, including reads, which broadens opportunities for sensitive data access. Because the token inherits all permissions of the active Google Cloud account, any mistake in account selection, project targeting, or downstream command handling can have significant impact on confidentiality and integrity.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

  1. Check active context — Run gcloud config list --format='text(core.account,core.project)' to display the active account and project. Present this to the user so they are aware of which credentials and project will be used.

  2. Generate access token — Always start by obtaining a fresh access token:

    bash
    ACCESS_TOKEN=$(gcloud auth print-access-token)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · installation.md (reported line 44)May include surrounding context.

gcloud config list --format='text(core.account,core.project)'

text

## Access Token

Before any Firestore API request, generate a fresh access token:
```bash

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · installation.md (reported line 46)May include surrounding context.

Access Token

Before any Firestore API request, generate a fresh access token:

bash
ACCESS_TOKEN=$(gcloud auth print-access-token)

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md
- **Use proper JSON formatting** — Firestore requires specific field value types (stringValue, booleanValue, integerValue, etc.).
- **Document ID generation** — When creating documents, if you don't specify `?documentId=YOUR_ID` in the URL, Firestore will automatically generate a unique document ID.
- **Include field paths in updateMask** — When updating, use `updateMask.fieldPaths` to specify which fields to update.
- **Never execute any command autonomously** — always present the full curl command to the user and wait for explicit approval before running it, including read-only operations.
- **Parse responses carefully** — Firestore returns data in a nested format with typed values.
- **Verify project ID** — Always confirm you're targeting the correct project before executing commands.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples.md (reported line 14)May include surrounding context.

Expected agent behavior:

  1. Run gcloud config list --format='text(core.account,core.project)' and show the active context to the user
  2. Get the project ID from the output (e.g., my-project)
  3. Construct the curl command:
    bash
    ACCESS_TOKEN=$(gcloud auth print-access-token)

Static analysis

No suspicious patterns detected.